Attor

Attor can obtain application window titles and then determines which windows to perform Screen Capture on.

Attor has opened the registry and performed query searches.

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.

Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.

Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).

Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .

Attor has exfiltrated data over the C2 channel.

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.

Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.

Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.

One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.

Attor’s plugin deletes the collected files and log files after exfiltration.

Attor has manipulated the time of last access to files and registry keys after they have been created or modified.

Attor has used FTP protocol for C2 communication.

Attor has staged collected data in a central upload directory prior to exfiltration.